Our work is closely related to other privacy attacks on machine learning models.
This work is mainly focused on developing attacks not for analysis purposes, but to demonstrate an attack [1]}, [2]}.
Jayaraman et al. also consider the relationship between privacy upper bounds and lower bounds, but do not construct as strong lower bounds as we do [3]}.
Even more similar is Jagielski et al. [4]},
who as we discussed earlier construct poisoning attacks to audit
differential privacy.
Our work is primarily different in that we construct lower bounds to measure the privacy assumptions, not just measure one set of configurations.
We additionally study much larger datasets ([4]} consider a two-class MNIST subset).
